You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "mengxzh (via GitHub)" <gi...@apache.org> on 2025/03/08 09:54:02 UTC
[I] feat: As a user, I want to custom oidc session, so that update openid-connect.lua [apisix]
mengxzh opened a new issue, #12028:
URL: https://github.com/apache/apisix/issues/12028
### Description
when i want to custom oidc session, i found this code looks like already supported
<img width="774" alt="Image" src="https://github.com/user-attachments/assets/6c7d93a9-fe68-409b-a400-02f5c2cb1dec" />
but when i use below code to update custom session use admin api
`
curl --request PATCH \
--url http://127.0.0.1:9180/apisix/admin/routes/oauth2-resource-server \
--header 'X-API-KEY: eZTssHqsNuUlJXzkCPqbhhWRxwVsZCRm' \
--header 'content-type: application/json' \
--data '{
"plugins": {
"openid-connect": {
"bearer_only": false,
"client_id": "oauth2-test",
"client_secret": "123456",
"discovery": "http://192.168.0.29:9303/.well-known/openid-configuration",
"introspection_endpoint_auth_method": "client_secret_basic",
"post_logout_redirect_uri": "http://127.0.0.1:9080",
"realm": "apisix",
"redirect_uri": "http://127.0.0.1:9080/call-back",
"session": {
"secret": "12e16f870756980a46d6c888086fe84afb96458616e175161fe3230e4fc4ae78",
"redis": {
"host": "192.168.0.29",
"port": "6379",
"prefix": "apisix-sessions:",
"database": 2
}
}
}
}
}'`
**And got a response like this**
**due to below check**
<img width="758" alt="Image" src="https://github.com/user-attachments/assets/1fbeb788-6473-43bf-b91d-c15c2fa0c9a9" />
how could i custom oidc session?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to custom oidc session, so that update openid-connect.lua [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #12028:
URL: https://github.com/apache/apisix/issues/12028#issuecomment-2760635246
> But lua-resty-session has different varies for session storage.
Can you elaborate on your original request? What do you expect the oidc authentication process to look like?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to custom oidc session, so that update openid-connect.lua [apisix]
Posted by "fernando-arellano (via GitHub)" <gi...@apache.org>.
fernando-arellano commented on issue #12028:
URL: https://github.com/apache/apisix/issues/12028#issuecomment-2895277215
One way that I've found we can configure the cookie sessions is through the cookie property which is not documented.
```
- config:
access_token_in_authorization_header: true
bearer_only: false
client_id: ...
client_secret: ...
discovery: ...
redirect_after_logout_uri: http://localhost:4200
redirect_uri: http://localhost:4200/login/redirect
scope: openid
session:
cookie:
samesite: None
secure: "true"
...
secret: "1234567890123456"
```
Although since is not documented I have no idea if that was the intended behavior. or it might break in the future.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to custom oidc session, so that update openid-connect.lua [apisix]
Posted by "juzhiyuan (via GitHub)" <gi...@apache.org>.
juzhiyuan commented on issue #12028:
URL: https://github.com/apache/apisix/issues/12028#issuecomment-4829417100
I believe this issue can be closed after https://github.com/apache/apisix/pull/13178 merged.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to custom oidc session, so that update openid-connect.lua [apisix]
Posted by "mengxzh (via GitHub)" <gi...@apache.org>.
mengxzh commented on issue #12028:
URL: https://github.com/apache/apisix/issues/12028#issuecomment-2757956070
@Baoyuantop Yes, cuz this restriction as you say, so I could not custom session where i store. But lua-resty-session has variety for session storage. I want use it, but in apisix could not set. If lift this limitaion, it will be flexible
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to custom oidc session, so that update openid-connect.lua [apisix]
Posted by "pfernandes21 (via GitHub)" <gi...@apache.org>.
pfernandes21 commented on issue #12028:
URL: https://github.com/apache/apisix/issues/12028#issuecomment-3036344837
Also having some issues with this. I would like to configure the idling_timeout of a session but I cant pass that param to the config because of this https://github.com/apache/apisix/blob/0bb54e0a9b18aaa3f2c609ebc0b6d3ea8b2c564c/apisix/plugins/openid-connect.lua#L87
Is there a reason to keep this? Its blocking most of the params from the resty config https://github.com/bungle/lua-resty-session?tab=readme-ov-file#session-configuration
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to custom oidc session, so that update openid-connect.lua [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #12028:
URL: https://github.com/apache/apisix/issues/12028#issuecomment-2756267660
https://github.com/apache/apisix/blob/release/3.11/apisix/plugins/openid-connect.lua#L67-L87
There is an additionalProperties restriction in this configuration that does not allow other fields, which is why you are returning errors with the admin api.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to custom oidc session, so that update openid-connect.lua [apisix]
Posted by "fernando-arellano (via GitHub)" <gi...@apache.org>.
fernando-arellano commented on issue #12028:
URL: https://github.com/apache/apisix/issues/12028#issuecomment-2894797783
> > But lua-resty-session has different varies for session storage.
>
> Can you elaborate on your original request? What do you expect the oidc authentication process to look like?
@Baoyuantop from my understanding we would like to be able to configure things like the session name. Domain SameSite ( Cookie settings ). That is currently supported but `lua-resty-sesion` and the `resty-oidc` however the plugin prohibits to configure that.
resti-oidi:
```
-- Configure lua-resty-session
-- The full list of configuration options is documented in the lua-resty-session GitHub repository: https://github.com/bungle/lua-resty-session?tab=readme-ov-file#session-configuration
local session_opts = {
-- When using cookies to store sessions, set a shared secret for session cookie encryption. This allows sessions to remain valid after a restart of nginx.
-- It also enables "stateless" session management, so multiple instances of nginx can handle requests without the need for "sticky" load balancing techniques.
-- secret = "xxxxxxxxxxxxxxxxxxx",
-- Optionally, set the cookie prefix to prevent accidental overwriting of the session cookie
-- cookie_prefix = "__Host-",
-- Login session cookies should be HTTP Only
cookie_http_only = true,
-- Login session cookies should be marked as "Secure"
cookie_secure = true,
-- Set the same site cookie policy
cookie_same_site = "Lax",
-- Set this to true if you want login session cookies to persist a browser restart
remember = true
}
-- call authenticate for OpenID Connect user authentication
local res, err = require("resty.openidc").authenticate(opts, nil, nil, session_opts) <------- Session options can be passed here.
```
However the plugin only allows to pass the secret via conf.secret here: https://github.com/apache/apisix/blob/0bb54e0a9b18aaa3f2c609ebc0b6d3ea8b2c564c/apisix/plugins/openid-connect.lua#L668
If we are allowed to remove the additional properties validation from https://github.com/apache/apisix/blob/0bb54e0a9b18aaa3f2c609ebc0b6d3ea8b2c564c/apisix/plugins/openid-connect.lua#L87
I believe we would be able to configure some of the session arguments unless there is a reason why we shouldn't configure those.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to custom oidc session, so that update openid-connect.lua [apisix]
Posted by "emil191995 (via GitHub)" <gi...@apache.org>.
emil191995 commented on issue #12028:
URL: https://github.com/apache/apisix/issues/12028#issuecomment-2986011193
I am not sure that with the current version of lua-resty-sesion and resty-oidc it is possible cos the versions used in APISIX. so need to update versions in APISIX and extend schema
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to custom oidc session, so that update openid-connect.lua [apisix]
Posted by "juzhiyuan (via GitHub)" <gi...@apache.org>.
juzhiyuan closed issue #12028: feat: As a user, I want to custom oidc session, so that update openid-connect.lua
URL: https://github.com/apache/apisix/issues/12028
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to custom oidc session, so that update openid-connect.lua [apisix]
Posted by "mengxzh (via GitHub)" <gi...@apache.org>.
mengxzh commented on issue #12028:
URL: https://github.com/apache/apisix/issues/12028#issuecomment-2767778159
@Baoyuantop The request and OIDC process remain unchanged, but the cookie after the OIDC authentication can be customized. For example, the secure can be set true, or the session after authentication can be stored in other locations such as Redis.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to custom oidc session, so that update openid-connect.lua [apisix]
Posted by "Baoyuantop (via GitHub)" <gi...@apache.org>.
Baoyuantop commented on issue #12028:
URL: https://github.com/apache/apisix/issues/12028#issuecomment-2753614389
What version are you using?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to custom oidc session, so that update openid-connect.lua [apisix]
Posted by "mengxzh (via GitHub)" <gi...@apache.org>.
mengxzh commented on issue #12028:
URL: https://github.com/apache/apisix/issues/12028#issuecomment-2756260064
@Baoyuantop version: 3.11
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As a user, I want to custom oidc session, so that update openid-connect.lua [apisix]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #12028:
URL: https://github.com/apache/apisix/issues/12028#issuecomment-4788556391
This issue has been marked as stale due to 350 days of inactivity. It will be closed in 2 weeks if no further activity occurs. If this issue is still relevant, please simply write any comment. Even if closed, you can still revive the issue at any time or discuss it on the dev@apisix.apache.org list. Thank you for your contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org